Pythia
Pythia is a Claude-powered oracle agent that intervenes in real time during malware emulation.
Core trick
Pauses an emulator at anti-analysis checks and asks the model for a constrained decision schema to patch, skip, or abort.
Tags
Description
Pythia is a Claude-powered oracle agent that intervenes in real time during malware emulation. Modern hostile samples detect sandboxes in seconds — timing checks, PEB reads, hash-based imports — and abort silently, leaving analysts with "no malicious behavior observed" reports.
Static rule-based bypasses don't scale to new variants.
Pythia takes a fourth path: when HexCore's emulator hits an anti-analysis check, the Oracle Hook pauses execution and asks Claude what to do. Patch a register? Skip an instruction? Read memory? Abort? The model reasons from CPU state plus a live disassembly window and responds
via a constrained decision schema. HexCore applies the decision, resumes emulation, and the malware never knows it was watched.
Validated against two self-authored red-team samples — v6.1 (9 evasion layers) defeated in 40 s / $0.037, v7.0 (added runtime integrity check, QPC tamper gate, and a two-stage URL decoder with a decoy beacon) defeated in 46 s / $0.081 on the first attempt. In v7, Pythia
explicitly noted "no decoy strings present" in her decision reasoning — she recognized the trap and avoided it without being told to.
AkashaCorporation/Project-Pythia★ 21 forksTypeScriptMITCreated Apr 21, 2026 · last push Apr 25, 2026
README excerpt
<div align="center"> <img src="./banner.png" alt="Pythia — Oracle Agent for HexCore" width="640"/> # Pythia — Oracle Agent for HexCore **Observe. Decide. Protect.** — *the Oracle Hook is the law.* </div> > *Autonomous reverse-engineering agent. Drives HexCore's emulation engine mid-execution, making live decisions that bypass anti-analysis, resolve hashed APIs, and extract real behavior from hostile samples.* **Project Pythia** is an Anthropic hackathon project (Apr 21-26, 2026). It combines two things that have never been glued together before: 1. **Issue [#17 Oracle Hook](https://github.com/AkashaCorporation/HikariSystem-HexCore/issues/17)** — a pause-and-respond callback system originally proposed by [@YasminePayload](https://github.com/YasminePayload) to let external agents intervene during headless emulation. 2. **Claude Agent SDK** — Anthropic's framework for building tool-wielding autonomous agents. Pythia is the bridge. She registers as an Oracle listener on a HexCore emulation session, receives Decision Requests at every hook trigger, inspects the machine state with her tool set, and issues Decisions that HexCore applies before resuming execution. --- ## Built on Pythia is built on top of **[HexCore](https://github.com/AkashaCorporation/HikariSystem-HexCore)**, an MIT + Apache 2.0 licensed binary analysis IDE maintained by @LXrdKnowkill. HexCore provides the execution infrastructure — decompilation pipeline, pattern matching engine (HQL), CPU emulation (Un